A risk can be defined by a product of a likelihood and impact of an event. A risk management tool can utilize various inputs to determine a risk associated with a particular endeavor. A risk management tool can be useful in an information technology (IT) environment. Identifying a risk in an IT environment can contribute to management and assessment of IT security risks.